ubuntu - UFW: Allow ping requests only for specific host -

-

i setuping server , must disable ping requests except me , list of hosts (aaa.bbb.ccc.ddd).

i using tool ufw, on ubuntu server, read have comment lines:

ok icmp codes

-a ufw-before-input -p icmp --icmp-type destination-unreachable -j accept -a ufw-before-input -p icmp --icmp-type source-quench -j accept -a ufw-before-input -p icmp --icmp-type time-exceeded -j accept -a ufw-before-input -p icmp --icmp-type parameter-problem -j accept -a ufw-before-input -p icmp --icmp-type echo-request -j accept,

however, doing disallow ping, problem because need "aaa.bbb.ccc.ddd" have response ping requests.

can me write correct command?

thank lot in advance.

i stumbled on 4 month old question. should listed on different stackexchange (such serverfault), developer needs configure firewall. is, i'm here answer you.

for firewall rules, you'll want accept packets safe ips first , drop rest. here's how did it:

let's assume want accept 1 safe ip pings , ip address '127.0.0.1'. of course, ip address want (just create more rules or define subnets additional addresses).

step 1

first thing check following in /etc/ufw/sysctl.conf

net/ipv4/icmp_echo_ignore_all=1

...should rewritten 0 if not already...

net/ipv4/icmp_echo_ignore_all=0

step 2

add rules ipv4 /etc/ufw/before.rules

-a ufw-before-input -p icmp --icmp-type echo-request –s 127.0.0.1 -m state --state established -j accept

step 3 (for ipv6 support)

add rules ipv6 /etc/ufw/before6.rules

-a ufw6-before-input -p icmpv6 --icmpv6-type echo-request –s 127.0.0.1 -m state --state established -j accept

step 4

now, restart firewall , drink beverage of choice.

service ufw restart

Comments

Post a Comment

Popular posts from this blog

c++ - Function signature as a function template parameter -

-
i'd use function signature template argument. works great classes, when try same trick function templates, msvc throws error: error c2768: 'func' : illegal use of explicit template arguments here's code: template <typename signature> void func(); template <typename r, typename a1> void func<r(a1)>(); what should make work? you cannot partially specialize function template, not supported language. can create partially specialized class template static member function, , possibly trampoline function instantiate class template , invoke static function. something this: namespace detail { template<typename signature> struct helper; template<typename r, typename a1> struct helper<r(a1)> { static void call() { // stuff r , a1... } }; } template<typename signature> void func() { detail::helper<signature>::call(); }
Read more

algorithm - What are some ways to combine a number of (potentially incompatible) sorted sub-sets of a total set into a (partial) ordering of the total set? -

-
i have sorting problem i'm pretty sure doesn't have canonical "answer" - has number of different approaches, each pros/cons. i'm interested in hearing different approaches. suppose bunch of people {p_i | i=1,...,m} ranking favorite ice cream flavors. in total there n different flavors, single person p_i ranks n_i << n flavors or familiar with. i'm interested in combining these sub-rankings plausible overall ranking of n flavors. for concrete situation: m , n both 1000 (by coincidence), , each n_i 20 . can assume there's enough overlap in flavors people rank such no flavor "isolated". again, i'm interested in hearing different ways approach this, if there isn't single clear answer. thanks! one way approach problem construct directed cyclic graph representing of constraints on ordering of elements. nodes in graph represent different elements compared , have edge first node second node if had ranked first e...
Read more

How to call a javascript function after the page loads with a chrome extension? -

-
there's function on page want call after loads. not own page, can't insert html it. can please provide specific examples how chrome extension or greasemonkey? (function submitaction() ). both chrome extensions , greasemonkey offer ways specify when script inject if executed. in chrome extension, you set in manifest : "content_scripts": [ { "run_at" : "document_idle", in greasemonkey compatible userscripts, set in metadata // @run-at document-end in both cases, have add script if want ensure resources loaded when function executed : document.addeventlistener('load', submitaction);
Read more